Cosmos Halt Secures $2.2M in Stolen ATOM, But Thousands Remain Missing

A nearly day-long halt on the Cosmos Hub network allowed validators to secure over $2.2 million in stolen ATOM, but around 169,000 tokens still escaped recovery.

The intervention followed a governance exploit on Neutron that led to the theft of funds from various protocols, including Astroport and Drop. The affected contracts were subsequently migrated to malicious code, allowing attackers to withdraw assets worth approximately $4.4 million, according to former Neutron contributor Spaydh.

Roughly 70% of the stolen ATOM remained on Cosmos Hub when validators stopped block production, leaving about $2.15 million within reach of the recovery operation. However, a later refund from THORChain reached the attacker after the recovery transaction had already executed, leaving around 168,990.9 ATOM outside the recovery process.

The tokens remained at the attacker-linked address for almost six hours before being transferred to Osmosis and sold in batches for about $266,841 USDC, with much of the proceeds subsequently converted into Ethereum.